ExamPark
Course menuDVA-C02

Exams / DVA-C02 / API authorisation and tokens / Question 2

DVA-C02 practice question: API authorisation and tokens (2 of 3)

Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

An internal service running on Amazon ECS calls a REST API in Amazon API Gateway. The developer wants only callers with a specific IAM role, the ECS task role, to be able to invoke one method, without managing any passwords or API tokens. Which TWO actions should the developer take? (Choose two.)

Choose two answers.

  1. A. Set the method's authorisation type to AWS_IAM.
  2. B. Create an API key, add it to a usage plan and give it to the service.
  3. C. Allow execute-api:Invoke on the method's ARN in the task role, and sign requests with SigV4.
  4. D. Add a Cognito user pool authoriser and send the task role ARN in the Authorization header.
  5. E. Enable CORS on the method and allow only the service's origin.
Show the answer and explanation

Answers: A, C

  • A. Right: Correct. With IAM authorisation, API Gateway checks the SigV4 signature and the caller's IAM permissions on every request.
  • B. Wrong: API keys are for metering and throttling, not for authorising callers, and the key would be a secret to manage.
  • C. Right: Correct. The task role's credentials sign each request, and its policy grants permission to invoke that method.
  • D. Wrong: A Cognito authoriser expects a user pool token. A role ARN is not a credential.
  • E. Wrong: CORS is a browser mechanism and does not authenticate server-to-server callers.

Explanation

IAM authorisation suits service-to-service calls inside AWS. The method's authorizationType is AWS_IAM, callers sign requests with their AWS credentials using Signature Version 4, and their IAM policy must allow execute-api:Invoke on the method's ARN. Without AWS_IAM on the method, the IAM policies have no effect.

Study

Keep practising

Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C02 practice examPractise API authorisation and tokensAll API authorisation and tokens questions